What Flux is and how it is built
Flux is a GitOps toolkit for Kubernetes. Rather than one large application, it is a group of single-purpose controllers. The source controller fetches artefacts from git, OCI registries or Helm repositories. The kustomize controller renders and applies Kustomize overlays. The helm controller manages Helm releases. The notification controller sends alerts and receives webhooks, and optional image controllers watch registries and update tags in git. Everything is expressed as Kubernetes custom resources, so a Flux setup reads like the rest of your cluster configuration.
Teams choose it when they want GitOps that feels like native Kubernetes, with small parts they can reason about and no extra control plane or UI to host. Our Flux GitOps consulting work is mostly platform engineering: structuring the fleet repository, ordering add-ons, bounding tenants and keeping upgrades uneventful. See the Flux glossary entry for a short definition.
How we run Flux in production
Bootstrap and self-management
Bootstrap installs the controllers and commits their manifests, plus a sync definition, into your repository. From then on Flux reconciles its own configuration. If a cluster is lost, you create a new one, run bootstrap against the same path, and it converges to the declared state. This is the foundation of everything else, and we cover installation trade-offs in ArgoCD and Flux installation.
A layered fleet repository
We usually split the repository into layers: cluster definitions, shared infrastructure and applications. Infrastructure is reconciled before applications through dependsOn, so a database operator or ingress controller exists before workloads that need it.
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
name: apps
namespace: flux-system
spec:
interval: 10m
dependsOn:
- name: infrastructure
sourceRef:
kind: GitRepository
name: flux-system
path: ./apps/production
prune: true
wait: true
timeout: 5m
prune: true removes resources deleted from git, which is powerful and deserves care in production. wait: true makes Flux check the health of what it applied, so a failing rollout shows as a failed reconciliation. Layout guidance is in GitOps repository structure design and promotion with Kustomize.
Helm with HelmRelease
A HelmRelease declares chart, version and values, and the helm controller installs and upgrades it, with options for retries and remediation when an upgrade fails. Charts can come from Helm repositories or OCI registries. For building your own charts, see Helm chart development.
Sources beyond git
Flux can reconcile from OCI artefacts as well as git. Publishing configuration as a versioned artefact from CI means clusters pull an immutable, signed bundle instead of tracking a branch, which suits environments where promotion should be an explicit act. It also reduces load on git hosting when you run many clusters. We choose between a git branch, a tag or an OCI artefact per environment, usually tracking a branch in development and pinned versions in production.
Security and access
- Impersonation for tenants. A Kustomization or HelmRelease can specify a service account to reconcile as. Combined with Kubernetes RBAC, a team can deploy only into its namespaces. Details in GitOps RBAC and access control.
- Secrets. Encrypt with SOPS and let Flux decrypt using a key held in the cluster, or use the External Secrets Operator. Protect and back up the decryption key. See Sealed Secrets and External Secrets Operator.
- Source verification. Flux can verify signed commits or signed OCI artefacts, which helps when git hosting is shared.
- Least-privilege git access. Use deploy keys or app tokens that can read only the needed repositories.
- Cross-namespace controls. Restrict which namespaces can reference sources and which can be targeted.
Cost and capacity
Flux controllers are lightweight, and the cost is largely the compute they use inside each cluster. Because each cluster runs its own Flux, there is no central instance to size, but you also have no single place to see everything. Reconciliation intervals are the main tuning knob: very short intervals on large repositories add load on git hosting and the source controller. We use webhooks to trigger reconciliation on push, and keep intervals modest as a safety net.
Day-2 operations
- Upgrades: run the Flux upgrade by updating bootstrap manifests in git, test on a non-production cluster, and read the release notes first.
- Visibility: export controller metrics to Prometheus, build Grafana dashboards for reconciliation status, and alert on stuck resources through monitoring with Grafana and Prometheus.
- Notifications: send alerts to chat when reconciliation fails. See GitOps deployment notifications.
- Image automation: use it where automatic tag bumps make sense, typically non-production, and keep production changes behind a pull request.
- Progressive delivery: Flagger adds canary and blue-green releases, covered in progressive delivery.
Failure modes we avoid
| Symptom | Cause | Our approach |
|---|---|---|
| Resources stuck not ready | Missing dependency order | Explicit dependsOn and health checks |
| Accidental deletion | prune with a mistaken commit | Review gates, suspend capability, care in production |
| Lost secrets after rebuild | Decryption key not backed up | Key escrow and tested recovery |
| Tenant overreach | Reconciling as cluster-admin | Service account impersonation |
| Hidden failures | No alerting | Notifications and metrics |
When to choose something else
If your developers expect a UI to browse application health, ArgoCD is often the more comfortable choice, and it offers ApplicationSets for large fleets. For one small cluster with simple needs, a pipeline running Helm may be enough for now. Flux and ArgoCD are both sound; running both on the same resources is a mistake, though a clear split of ownership can work. Pair either with a CI tool such as GitLab CI/CD or GitHub Actions to build and test, and with Helm for packaging.
To plan a Flux rollout, see our GitOps service or contact us.
Official documentation: fluxcd.io